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APR  -  2  2012 

MEMORANDUM  FOR  AUDITOR  GENERAL,  DEPARTMENT  OF  THE  ARMY 

AUDITOR  GENERAL,  DEPARTMENT  OF  THE  NAVY 
AUDITOR  GENERAL,  DEPARTMENT  OF  THE  AIR  FORCE 

SUBJECT:  FY  201 1  External  Reviews  of  the  Quality  Control  Systems  of  the  Military 
Department  Audit  Agencies  (Report  No.  DODIG-20 12-070) 

Section  8  (c)(6)  of  the  Inspector  General  Act  of  1978,  as  amended,  requires  the  Inspector 
General  of  the  Department  of  Defense  to  monitor  and  evaluate  the  adherence  of  Defense  auditors 
to  internal  audit,  contract  audit,  and  internal  review  principles,  policies,  and  procedures. 
Generally  accepted  government  auditing  standards  (GAGAS)  issued  by  the  Comptroller  General 
of  the  United  States  require  that  organizations  conducting  government  audits  and/or  attestation 
engagements  have  an  appropriate  internal  quality  control  system  in  place  and  undergo  an 
external  review  at  least  once  every  three  years  by  reviewers  independent  of  the  audit 
organization  being  reviewed. 

Results  of  the  Military  Department  Audit  Agencies  External  Reviews.  We  are 

issuing  a  pass  opinion  on  the  system  of  audit  quality  control  for  each  of  the  Military  Department 
audit  agencies  -  Army  Audit  Agency,  Naval  Audit  Service,  and  the  Air  Force  Audit  Agency. 

We  determined  that  the  systems  of  quality  control  for  each  of  the  Military  Department  audit 
agencies  are  suitably  designed  and  complied  with  to  provide  reasonable  assurance  that  the 
Military  Department  audit  agencies  conform  to  applicable  auditing  standards,  policies,  and 
procedures  in  the  conduct  of  their  work.  We  made  this  determination  based  on  our  oversight  of 
the  external  peer  reviews  conducted  by  the  Military  Department  audit  agencies  on  each  other  and 
our  quality  control  reviews  of  their  Special  Access  Program  (SAP)  audits. 

Key  Observations  Noted  During  the  Review  Process.  Each  review  team  made 
observations  and  suggested  actions  to  the  audit  agencies  to  strengthen  their  systems  of  quality 
control.  Concerns  identified  during  the  reviews  were  not  cumulatively  significant  enough  to 
indicate  that  material  deficiencies  existed  for  complying  with  GAGAS;  however,  the  Military 
Department  audit  agencies  should  give  particular  regard  to  the  following. 

Independence.  While  there  is  no  indication  of  external  or  personal  impairments 
to  independence,  two  Military  Department  audit  agency’s  non-SAP  audit  quality  control  reviews 
identified  the  need  for  improvements,  including  documentation  of  independence  for  audit 
personnel.  In  addition,  one  audit  agency’s  SAP  quality  control  review  identified  issues  with 
documentation  of  independence.  Each  review  identified  specific  areas  for  improvement  in 
documenting  independence,  especially  of  audit  directors  or  managers,  and  in  ensuring  that 
independence  statements  of  auditors  assigned  to  the  audit  are  thoroughly  completed  and 
documented.  Recommendations  on  independence  addressed  the  need  for  all  individuals  assigned 
to  an  audit  to  prepare  an  independence  statement  documenting  their  independence. 


Planning.  All  of  the  Military  Department  audit  agencies’  quality  control  reviews 
of  the  non-SAP  audits  addressed  areas  for  improvement  in  audit  planning.  In  addition  to  the 
quality  control  reports  of  the  non-SAP  audits,  one  quality  control  report  of  the  SAP  audits 
addressed  areas  for  improvement  in  planning.  Each  review  identified  specific  areas  for 
improvement  in  audit  planning  to  include  ensuring  that  planning  meetings  are  documented,  that 
audit  steps  in  the  audit  program  are  completed,  that  changes  to  the  audit  program  are 
documented,  and  that  a  fraud  assessment  is  completed.  While  the  policies  established  for 
planning  were  appropriate  in  implementing  GAGAS,  recommendations  were  also  made  to 
include  providing  training  to  personnel  addressing  GAGAS  planning  standards  and  audit  agency 
planning  requirements  documentation. 

Supervision.  For  supervision,  each  of  the  Military  Department  audit  agencies’ 
non-SAP  audit  quality  control  review  stated  that  supervision  needed  improvement.  In  addition, 
one  SAP  audit  quality  control  review  also  identified  needed  improvements  to  supervision.  Each 
review  identified  specific  improvements  including  the  need  for  supervisors  to  document  their 
supervisory  reviews  and  perform  the  reviews  timely.  Recommendations  regarding  supervision 
called  for  audit  agencies  to  either  provide  training  to  audit  supervisors  or  remind  audit 
supervisors  to  complete  and  perform  their  supervisory  reviews  timely. 

Audit  Evidence  and  Documentation.  Each  of  the  Military  Department  audit 
agencies’  non-SAP  audit  quality  control  review  identified  areas  for  improvement  in  audit 
evidence  and  documentation.  In  addition,  one  SAP  audit  quality  control  review  also  identified 
needed  improvements.  Each  review  identified  specific  improvements  for  audit  evidence  and 
documentation  to  include  placing  computer-processed  data  reliability  documentation  in  working 
papers  and  summarizing  or  referencing  all  results  to  supporting  work  papers.  Recommendations 
on  audit  evidence  and  documentation  called  for  providing  training  to  audit  personnel  or 
reminding  audit  personnel  to  include  sufficient  evidence  and  documentation  to  support  the  audit 
work,  to  include  necessary  working  paper  elements  (e.g.,  purpose,  sources,  scope,  results,  and 
conclusion)  and  to  properly  cross-reference  audit  working  papers. 

Reporting.  Each  of  the  Military  Department  audit  agencies’  non-SAP  audit 
quality  control  review  identified  areas  for  improvement  to  reporting.  Each  review  identified  the 
need  for  specific  improvements  in  reporting  such  as  including  the  correct  GAGAS  statement  in 
audit  reports  and  adequately  describing  in  the  scope  and  methodology  how  a  sample  was 
selected.  Recommendations  on  reporting  included  training  auditors  to  use  the  updated  GAGAS 
compliance  statement,  updating  report  templates  to  include  the  updated  GAGAS  statements,  and 
directing  auditors  to  identify  in  the  scope  and  methodology  the  actual  samples  used  and  the 
criteria/rational  for  each  sample  selection. 

Quality  Control.  All  of  the  Military  Department  audit  agencies’  non-SAP  and 
two  of  the  SAP  audit  quality  control  reviews  identified  areas  for  improvement  in  quality  control. 
Each  review  identified  specific  areas  for  improvement  to  include  performing  an  independent 
reference  review  on  significant  changes  to  the  report,  and  ensuring  that  quality  control  checklists 
are  completed  and  results  of  internal  quality  control  reviews  are  provided  to  auditors  in  a  timely 
manner.  Recommendations  addressing  quality  control  issues  included  ensuring  that  independent 
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reference  reviews  on  reports  are  completed,  that  checklists  are  completed  before  audit  reports  are 
issued,  and  that  internal  audit  quality  control  results  are  provided  to  auditors  in  a  timely  manner. 

Competence.  Two  of  the  three  Military  Department  audit  agencies’  non-SAP 
audit  quality  control  reviews  identified  areas  for  improvement  in  competence,  particularly  in 
documenting  continuing  professional  education.  Recommendations  to  correct  the  continuing 
professional  education  documentation  issue  included  training  auditors  on  requirements  and 
documentation,  and  re-emphasizing  the  need  for  audit  personnel  to  retain  continuing  professional 
education  documentation  for  a  set  period  of  time. 

External  Review  Process  and  Methodology.  The  Office  of  the  Assistant  Inspector 
General  for  Audit  Policy  and  Oversight  and  the  Military  Department  audit  agencies  conducted 
this  review  in  accordance  with  the  Council  of  Inspectors  on  Integrity  and  Efficiency  (CIGIE) 
Audit  Committee’s  Guide  for  Conducting  External  Peer  Reviews  of  the  Audit  Organizations  of 
Federal  Offices  of  Inspector  General,  dated  March  2009.  In  addition,  the  Office  of  the  Assistant 
Inspector  General  for  Audit  Policy  and  Oversight  conducted  the  quality  control  review  of  SAP 
audits  in  accordance  with  the  Quality  Standards  for  Inspection  and  Evaluation.  We  performed 
procedures  to  provide  a  basis  for  reliance  on  the  Military  Department  audit  agencies’  review 
results  and  to  ensure  that  the  CIGIE  guidelines  were  consistently  applied.  We  attended  planning 
meetings,  reviewed  point  papers  for  each  of  the  audits  selected,  and  reviewed  previous  quality 
control  reviews  for  implementation  of  suggested  actions  or  recommendations. 

For  the  review  of  SAP  audits,  we  judgmentally  selected  two  SAP  audits  from  each 
Military  Department  audit  agency  to  review.  We  reviewed  the  SAP  audits  using  the  CIGIE 
guide  and  the  Quality  Standards  for  Inspections  and  Evaluations  to  ensure  consistency  with  the 
Military  Department  audit  agencies’  review  of  non-SAP  audits,  and  to  reflect  the  unique  nature 
of  auditing  within  a  SAP  environment. 

Limitations  of  Reviews.  The  Military  Department  audit  agencies  and  the  Office  of  the 
Assistant  Inspector  General  for  Audit  Policy  and  Oversight  quality  control  systems  external 
reviews  would  not  necessarily  detect  all  weaknesses  in  the  system  of  quality  control  or  all 
instances  of  noncompliance  because  the  reviews  were  based  on  selective  tests.  There  are 
inherent  limitations  in  considering  the  potential  effectiveness  of  any  quality  control  system.  In 
performing  most  control  procedures,  departures  can  result  from  misunderstanding  of  instructions, 
mistakes  of  judgment,  carelessness,  or  other  human  factors.  Projecting  the  evaluation  of  a 
quality  control  system  into  the  future  is  subject  to  the  risk  that  one  or  more  procedures  may 
become  inadequate  as  conditions  change  or  the  degree  of  compliance  with  procedures 
deteriorate. 

The  external  peer  review  opinion  reports  of  the  Military  Department  audit  agencies 
perfonning  the  reviews,  the  associated  Letters  of  Comments,  and  the  Office  of  the  Inspector 
General  for  Audit  Policy  and  Oversight  reports  on  the  SAP  audits  for  each  Military  Department 
audit  agency  should  be  considered  jointly  as  our  basis  for  supporting  a  pass  opinion  on  their 
systems  of  audit  quality  control. 


3 


If  you  have  any  questions,  please  contact  Ms.  Carolyn  R.  Davis  at  (703)  604-8877 
(DSN  664-8877)  or  by  e-mail,  carolvn.davis@dodig.mil. 


/^Randolph  R.  Stone,  SES 
\  Deputy  Inspector  General 
Policy  and  Oversight 
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